/*
 *      idmp.c
 *      
 *      Copyright 2009 Daniele Ricci <denn86@gmail.com>, Luca Saccagi <luksak86@gmail.com>
 *      
 *      This program is free software; you can redistribute it and/or modify
 *      it under the terms of the GNU General Public License as published by
 *      the Free Software Foundation; either version 2 of the License, or
 *      (at your option) any later version.
 *      
 *      This program is distributed in the hope that it will be useful,
 *      but WITHOUT ANY WARRANTY; without even the implied warranty of
 *      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *      GNU General Public License for more details.
 *      
 *      You should have received a copy of the GNU General Public License
 *      along with this program; if not, write to the Free Software
 *      Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
 *      MA 02110-1301, USA.
 */

/*! \mainpage DILCA - Distributed IDMEF Logical Correlation Architecture
 * \author Daniele Ricci <denn86@gmail.com>, Luca Saccagi <luksak86@gmail.com>
 * \section purpose Synopsis
 * DILCA is a distributed logical correlation and reaction architecture featuring collection and correlation of IDMEF formatted log events (Intrusion Detection Message Exchange Format - RFC 4765) through a multi-step signature based system.
 * ILCE (IDMEF Logical Correlation Engine) is the core of the architecture, which parses logs on the fly and generates reaction events on previously created policies (builted into multi-step signature system).
 * Therefore these reaction events are sent to each DILCA Manager node, and forwarded to the right target Agent handled by that node (DILCA Agent/Plugin).
 * Every Agent/Plugin sends local IDMEF logs to the corresponding DILCA manager and receives reaction events from it.
 * IDXP (Intrusion Detection Exchance Protocol - RFC 4767) is the standard protocol used during IDMEF,Signatures and Reactions exchanges
 * \section compile Compile Optipons
 * gcc `xml2-config --cflags --libs` `pkg-config --cflags --libs vortex` -lrt idmp.c -o idmp
 */

/** \file idmp.c
 * This is the source file which includes the IDMP main function.
 */


#include "idmp.h"
#include "set.c"
#include "filter.c"
#include "misc.c"
#include "comm.c"
#include "datastruct.c"
#include "queryperf.c"
#include "filter/Xpath.c"
#include "filter/IP.c"
#include "filter/Time.c"
#include "filter/Assessment.c"
#include "filter/Classification.c"
#include "filter/OtherAlert.c"
#include "visual.c"
#include "configuration.c"
#include "debug.c"



#ifdef LIBXML_TREE_ENABLED

/**\brief Main function.
 * The main() function creates AlertList pointers for the first and the last alert in alert-list<br>
 * Therefore it creates a connection and, after struct initialization stuff and idmef first-loading,
 * IDMP starts listening for a BEEP connection on the configured port.<br>
 * When a new connection request arrives, IDMP accepts it, begins TLS negotiation and performs SASL 
 * authentication.<br>
 * Now it's time to poll the dynamic alert-receiver directory in order to retrieve and load new alerts.
 */
int main(int argc, char **argv){
	AlertList *top;//!Pointer creation for the first alert in alert-list
	AlertList *last=NULL;//!Pointer creation for the last alert in alert-list
	VortexConnection *cn=NULL;//!Pointer for the connection

	version(argc,argv);
	
	xmlInitParser();
	(argc >= 1) ? load_conf(argv[1]) : load_conf(NULL);
	/*DBG*/DEBUG == DBG_CONF ? print_conf(c0) : 0;
	top=NULL;
	last=idmp_init(top);//Dopo aver inizializzato le strutture di indicizzazione e creato la lista degli alert
	cn=vortex_listener_new (c0->srv_ip,c0->srv_port,NULL,NULL);//Si avvia un listener per una sessione BEEP
	vortex_listener_set_on_connection_accepted(NULL, NULL);//Quando arriva una richiesta di connessione la si accetta
	vortex_tls_accept_negotiation(NULL,certificate_file_location,private_key_file_location);//Si effettua la negoziazione TLS sul canale
	if (!vortex_sasl_accept_negotiation(VORTEX_SASL_CRAM_MD5)){//Si controlla la disponibilità del profilo SASL
		printf ("ERR - Unable  accept SASL CRAM MD5 profile");
		return -1;
	}
	vortex_sasl_set_cram_md5_validation((VortexSaslAuthCramMd5)sasl_cram_md5_validation);//Si effettua l'autenticazione
	
	idmp_dir_polling(last);//Si rimane in polling sulla directory degli alert dinamici
	/*DBG*/DEBUG == DBG_INDEXSTRUCT ? printIndexStruct(1,1) : 0;
    vortex_listener_wait();//E si passa allo stato di attesa di richieste da parte del listener
	
	vortex_exit();
    return 0;
}
#else
int main(int argc, char **argv) {
    fprintf(stderr, "ERR - Tree support not compiled in\n");
    exit(1);
}
#endif
